Lock down the registration of blob:chrome-extension:// URLs

chrome/browser/extensions/process_manager_browsertest.cc

Index: chrome/browser/extensions/process_manager_browsertest.cc
diff --git a/chrome/browser/extensions/process_manager_browsertest.cc b/chrome/browser/extensions/process_manager_browsertest.cc
index 62f4e4296e32215259c288a0a9ba8c34cede5b6d..c4b0d9aaee4160080f57d1b734bb673522d809bf 100644
--- a/chrome/browser/extensions/process_manager_browsertest.cc
+++ b/chrome/browser/extensions/process_manager_browsertest.cc
@@ -19,6 +19,7 @@
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
+#include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
@@ -674,6 +675,47 @@ IN_PROC_BROWSER_TEST_F(ProcessManagerBrowserTest,
   content::RenderFrameHost* main_frame = tab->GetMainFrame();
   content::RenderFrameHost* extension_frame = ChildFrameAt(main_frame, 0);
 
+  // Validate that permissions have been granted for the extension scheme
+  // to the process of the extension iframe.
+  content::ChildProcessSecurityPolicy* policy =
+      content::ChildProcessSecurityPolicy::GetInstance();
+  EXPECT_TRUE(policy->CanRequestURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("blob:chrome-extension://some-extension-id/some-guid")));

[Devlin, 2016/09/29 17:31:09]

nit: I'd recommend using some kind of valid id, because I could definitely see
us adding logic to disallow invalid ids (or even foreign ids).

[ncarter (slow), 2016/09/29 21:01:45]

Your point is good. It would actually be pretty straightforward to convert the
GrantScheme calls in this CL to be GrantOrigin() based: we already have a
particular extension in hand when we're doing the granting.

The only reason I haven't done this, is because I'm paranoid about whether we
have any races between the Grant() operations on the UI thread, and the
CanAccessWhatever checks on the IO thread, and making the grant be scheme-based
seemed harder to screw up (the risk being, I guess, if we ever have a case where
one extension can do a renderer-initiated, in-process navigation to another
extension? Like I said, I'm paranoid here.)

For now, though, I prefer this test to use invalid ids only; it makes it clearer
that the enforcement today is based simply on the scheme. And since this test
includes both EXPECT_TRUE and EXPECT_FALSE cases, I believe this test will start
failing if we add any kind of logic to disallow invalid ids. At that point, I'd
hope that we would expand this to include both valid and invalid ids.

+  EXPECT_TRUE(policy->CanRequestURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("blob:chrome-extension://some-extension-id/some-guid")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("chrome-extension://some-extension-id/resource.html")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("chrome-extension://some-extension-id/resource.html")));
+  EXPECT_TRUE(policy->CanCommitURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("blob:chrome-extension://some-extension-id/some-guid")));
+  EXPECT_FALSE(policy->CanCommitURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("blob:chrome-extension://some-extension-id/some-guid")));
+  EXPECT_TRUE(policy->CanCommitURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("chrome-extension://some-extension-id/resource.html")));
+  EXPECT_FALSE(policy->CanCommitURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("chrome-extension://some-extension-id/resource.html")));
+  EXPECT_TRUE(policy->CanCommitURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+  EXPECT_FALSE(policy->CanCommitURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+
   // Open a new about:blank popup from main frame.  This should stay in the web
   // process.
   content::WebContents* popup =